ICS Cybersecurity and Safety Convergence

In this article, I will discuss the interdependency between cybersecurity in the industrial space and physical security where cybersecurity plays an important role in the safety of instrument systems. A cyber breach to the Process Control Network could lead to a halt of production but also to physical damage to the plant or even the human workforce. Industries and governments are increasingly aware that security threats are nowadays not only limited to cyber but can also have physical implications, impacting the integrity and availability of Safety Instrumented Systems (SIS). A programmable electronic SIS with network communication could be sabotaged or cyber attacked by malware.

Due to the Covid-19 pandemic, organizations are looking for ways to continue their operations, attempting to minimize its economic impact. What is currently happening around the world is unprecedented, and refineries, chemical plants, mines and manufacturing facilities are all working to adjust to the new reality as fast as they can.

Many organizations consider the risks of cybersecurity, though these organizations believe that safety instrumented systems have the functionality to reduce risks with the safety integrity level. That does not mean the SIS is immune to physical or Cyber threats.

There have been numerous incidents of attacks on oil & gas, mining companies and petrochemical plants, which have threatened or impacted the ICS and SIS of the critical infrastructures around the globe. Some examples of the published incidents include:

1. Stuxnet virus in 2010 
2. Shamoon I and II 
3. HAVEX in 2013
4. Ukrainian power grid attack N.1 in 2015
5. Ukrainian power grid attack N.2 in 2016 
6. Triton malware targeted SIS in Middle East in 2017 

There is a lot to be done, but also there is an ongoing debate about how cybersecurity and process safety in ICS environments are related or should be more correlated. Let me start by laying out the safety layers of physical protection:

1. Alarms, Human Machine Interface
2. Interlocks, Enable Interlocking in PLC
3. Safety instrumented systems, Emergency Shutdown (ESD) System
4. High Integrity Pressure Protection Systems (HIPPS)
5. Emergency procedures, Occupational Safety and Health Administration (OSHA 3088)

The intersection area for cybersecurity and safety is the functional safety where it is implemented using programmable electronic devices. Below here I am showing an example of mapping between the ICS cybersecurity and process safety management: 

There are many techniques to analyze process safety for a specific production process. One of methods to analyze the process safety risk are Process Hazard Analysis (PHA), Hazard and Operability study (HAZOP), and Layers of Protection Analysis (LOPA).
What drove me write this article is that I wanted to bring your attention to the importance of the convergence between ICS Cybersecurity and safety. I would stalwartly recommend organizations that have critical infrastructure to consider conducting Cyber Process Hazard Analysis to map all the gaps.

1. ICS Cybersecurity & Process Safety are a journey, not a destination.
2. Always remember that cyber risks are real, and potentially catastrophic to the environment, life and company brand.
3. Leverage learnings from process safety management into your security program.

A final thought: What can the rapidly evolving ICS cybersecurity landscape learn from the hard lessons of process safety management?

Manager OT/ICS, Cybersecurity
KPMG in Saudi Arabia